Referer
property Referer: string read;
Example
procedure ScriptEvent(var Value: variant);
begin
if Request <> nil then
Value := Request.Referer
else
Value := '';
end;
Usage
Returns Velox's selected optional Referer header as untrusted text without proving the request's origin.
Additional Technical Info
Referer returns the first Referer request-header value selected by Indy. The historical misspelling is the standard field name. Velox does not parse the URI, remove credentials/fragments, validate an origin or check that the referenced resource actually initiated the request.
Clients and intermediaries can omit, truncate or alter this privacy-sensitive field, and non-browser callers can send arbitrary text. It is therefore unsuitable as sole CSRF protection, authentication, tenant selection or access control. Use approved origin/token controls and authenticated identity for security decisions.
If analytics/troubleshooting needs the value, length-bound it, parse as a URI, redact user information/query secrets and avoid ordinary logs where possible. Do not reflect it into a redirect or HTML response without strict allow-listing and output encoding.
Empty means no selected value; duplicates are not combined by this getter. Test Request for nil.
External references
Created 2026-07-15